A framework for anomaly detection in internet of things / Dina Ezzat Ahmed ; Supervised Neamat Eltazi , Waleed Helmy

Thesis (Ph.D.) - Cairo University - Faculty of Computers and Artificial Intelligence - Department of Information Systems

Anomaly detection is a challenging problem that has been studied within various domains. Anomaly detection techniques have been enhanced over the recent years, however, the increased volume of data in new environments like Internet of Things (IoT) created huge obstacles that can{u2019}t be addressed by current anomaly detection approaches. Current approaches have major limitations which are: the lack of specifying the type of the point anomaly, the inadequate consideration of the contextual attributes and the delay of detecting the collective anomalies. As a result, enhanced anomaly detection approaches should be developed to cope with IoT applications. In this thesis, we propose a framework which consists of three main modules, each module is responsible for tackling a certain problem related to anomaly detection in IoT. In IoT, detecting anomalies is a complex task because there is a high noise rate since IoT heavily relies on sensors which may have low power or poor quality. An anomaly can indicate the occurrence of an event or can be noise resulting from an error in the sensor. An event is an incident which took place at a certain timestamp while noise is just an error. An event and noise are both interpreted as anomalies but actually, they have two totally different meanings. The first module proposes a novel algorithm to differentiate between an event and noise of sensors{u2019} data in IoT since both of them are considered as anomalies.The proposed algorithm used the sensors{u2019} values of various timestamps and the correlation existence between the sensors to differentiate between an event and noise.The second module proposes an algorithm to detect contextual anomalies in IoT.The process of detecting contextual anomalies is different from that of detecting point anomalies as the context has to be taken into consideration in the anomaly detection process

Issued also as CD